New ToneShell Variant Uses Task Scheduler COM Service to Maintain Persistence

The latest ToneShell variant adds a new persistence mechanism by leveraging the Windows Task Scheduler COM service, marking a notable evolution in its capabilities, as reported by gbhackers. It creates a scheduled task named “dokanctl” that runs every minute from a randomly named folder inside the user’s AppData directory, with the backdoor copying itself and supporting DLLs (msvcr100.dll, msvcp100.dll, mfc100.dll) to a newly created six-character uppercase directory.

The malware enforces a single-instance policy using the mutex “Global\\SingleCorporation12AD8B” before proceeding with installation, and it begins operation only after passing a check that screens for Google Drive synchronization paths. According to Intezer, this ToneShell variant is associated with the Mustang Panda group’s China-nexus interests and continues to target Myanmar, including distribution through archives with Burmese filenames.

It also exhibits sophisticated anti-analysis techniques, such as rapid file operations, jittered sleep loops, and a TLS-like, XOR-encoded command-and-control protocol, all designed to hinder automated analysis. Mitigations focus on detecting the dokanctl task, AppData folder activity, the mutex, and the C2 communications.